diff --git a/backend/src/main/java/com/hiveops/guide/service/MarkdownGuideService.java b/backend/src/main/java/com/hiveops/guide/service/MarkdownGuideService.java
index 49a6534..95a9d99 100644
--- a/backend/src/main/java/com/hiveops/guide/service/MarkdownGuideService.java
+++ b/backend/src/main/java/com/hiveops/guide/service/MarkdownGuideService.java
@@ -101,13 +101,15 @@ public class MarkdownGuideService {
 
     /** Audience ladder: customer < internal < dev < bcos.
      *  First the environment cap (served tiers), then the caller's role.
-     *  customer→all · internal/dev→MSP or BCOS admin · bcos→BCOS admin only. */
+     *  customer→all · internal→MSP or BCOS admin · dev/bcos→BCOS admin only.
+     *  NB: 'dev' is developer/architecture content and is BCOS-only — it must NOT be
+     *  gated at MSP (issue #18). Only 'internal' is shared with MSP admins. */
     private boolean visible(GuideDoc d, boolean includeInternal, boolean includeBcos) {
         String a = d.audience();
         if (!served().contains(a)) return false;      // environment cap (prod = customer,internal)
         return switch (a) {
-            case "bcos" -> includeBcos;
-            case "internal", "dev" -> includeInternal;
+            case "bcos", "dev" -> includeBcos;        // BCOS_ADMIN only
+            case "internal" -> includeInternal;       // MSP_ADMIN or BCOS_ADMIN
             default -> true;                          // customer
         };
     }
diff --git a/backend/src/main/resources/content/analytics/adoons/testing.md b/backend/src/main/resources/content/analytics/adoons/testing.md
index 4695944..6b7ffad 100644
--- a/backend/src/main/resources/content/analytics/adoons/testing.md
+++ b/backend/src/main/resources/content/analytics/adoons/testing.md
@@ -3,7 +3,7 @@ module: analytics.adoons
 title: Adoons Insights
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Adoons Insights** (the **Fleet Insights** tab in Analytics, `analytics.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/analytics/agents/testing.md b/backend/src/main/resources/content/analytics/agents/testing.md
index 6c90c2b..58ad803 100644
--- a/backend/src/main/resources/content/analytics/agents/testing.md
+++ b/backend/src/main/resources/content/analytics/agents/testing.md
@@ -3,7 +3,7 @@ module: analytics.agents
 title: Agents
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Agents** tab in HiveIQ Analytics (`analytics.bcos.dev`). This tab is **view-only** — there is nothing to create, edit, or push. Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/analytics/cash/testing.md b/backend/src/main/resources/content/analytics/cash/testing.md
index 5a49c3e..4b06d95 100644
--- a/backend/src/main/resources/content/analytics/cash/testing.md
+++ b/backend/src/main/resources/content/analytics/cash/testing.md
@@ -3,7 +3,7 @@ module: analytics.cash
 title: Cash Intelligence
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Cash Intelligence** tab (`analytics.bcos.dev`). Open the tab in the UI and mark each row Pass or Fail. This tab is **view-only** — there is nothing to create, edit, or delete.
diff --git a/backend/src/main/resources/content/analytics/fleet-health/testing.md b/backend/src/main/resources/content/analytics/fleet-health/testing.md
index bb2c3d6..9f1043f 100644
--- a/backend/src/main/resources/content/analytics/fleet-health/testing.md
+++ b/backend/src/main/resources/content/analytics/fleet-health/testing.md
@@ -3,7 +3,7 @@ module: analytics.fleet-health
 title: Fleet Health
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Fleet Health** tab in **Analytics** (`analytics.bcos.dev`). Click through in the UI and mark each row Pass or Fail. This screen is **read-only** — there is nothing to create, edit, or delete.
diff --git a/backend/src/main/resources/content/analytics/incidents/testing.md b/backend/src/main/resources/content/analytics/incidents/testing.md
index a868947..b9b7da6 100644
--- a/backend/src/main/resources/content/analytics/incidents/testing.md
+++ b/backend/src/main/resources/content/analytics/incidents/testing.md
@@ -3,7 +3,7 @@ module: analytics.incidents
 title: Incident Trends
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Incident Trends** tab in Analytics (`analytics.bcos.dev`). This tab is **read-only** — there is nothing to create, edit, or delete, so the tests focus on the four panels rendering correctly and on role scoping. Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/analytics/transactions/testing.md b/backend/src/main/resources/content/analytics/transactions/testing.md
index cf7c02a..0683e19 100644
--- a/backend/src/main/resources/content/analytics/transactions/testing.md
+++ b/backend/src/main/resources/content/analytics/transactions/testing.md
@@ -3,7 +3,7 @@ module: analytics.transactions
 title: Transactions
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Transactions** tab in **Analytics** (`analytics.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/analytics/uptime/testing.md b/backend/src/main/resources/content/analytics/uptime/testing.md
index 6bd0bfc..f06b97a 100644
--- a/backend/src/main/resources/content/analytics/uptime/testing.md
+++ b/backend/src/main/resources/content/analytics/uptime/testing.md
@@ -3,7 +3,7 @@ module: analytics.uptime
 title: Uptime
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Uptime** tab in Analytics (`analytics.bcos.dev`). This screen is **read-only** — there are no buttons, forms, or actions, so the tests are all about what you can *see*. Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/aria/dashboard/testing.md b/backend/src/main/resources/content/aria/dashboard/testing.md
index f5aa532..42cedec 100644
--- a/backend/src/main/resources/content/aria/dashboard/testing.md
+++ b/backend/src/main/resources/content/aria/dashboard/testing.md
@@ -3,7 +3,7 @@ module: aria.dashboard
 title: Threat Dashboard
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **ARIA Threat Dashboard** (`aria.bcos.dev`) — the landing screen of the ARIA SPA. Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/aria/device-posture/testing.md b/backend/src/main/resources/content/aria/device-posture/testing.md
index 01b422d..a22c096 100644
--- a/backend/src/main/resources/content/aria/device-posture/testing.md
+++ b/backend/src/main/resources/content/aria/device-posture/testing.md
@@ -3,7 +3,7 @@ module: aria.device-posture
 title: Device Posture
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Device Posture** (`aria.bcos.dev`). Click through in the UI and mark each row Pass or Fail. This screen is **read-only** — there is nothing to create, edit, or delete.
diff --git a/backend/src/main/resources/content/aria/ioc-feeds/testing.md b/backend/src/main/resources/content/aria/ioc-feeds/testing.md
index a55e306..e433df0 100644
--- a/backend/src/main/resources/content/aria/ioc-feeds/testing.md
+++ b/backend/src/main/resources/content/aria/ioc-feeds/testing.md
@@ -3,7 +3,7 @@ module: aria.ioc-feeds
 title: IOC Feeds
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **IOC Feeds** in ARIA (`aria.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/aria/ioc-management/testing.md b/backend/src/main/resources/content/aria/ioc-management/testing.md
index c65d9a8..4eda328 100644
--- a/backend/src/main/resources/content/aria/ioc-management/testing.md
+++ b/backend/src/main/resources/content/aria/ioc-management/testing.md
@@ -3,7 +3,7 @@ module: aria.ioc-management
 title: IOC Management
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **IOC Management** in ARIA (`aria.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/aria/precursor-alerts/testing.md b/backend/src/main/resources/content/aria/precursor-alerts/testing.md
index 7fefe09..2ba7f89 100644
--- a/backend/src/main/resources/content/aria/precursor-alerts/testing.md
+++ b/backend/src/main/resources/content/aria/precursor-alerts/testing.md
@@ -3,7 +3,7 @@ module: aria.precursor-alerts
 title: Precursor Alerts
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Precursor Alerts** (`aria.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/aria/threat-events/testing.md b/backend/src/main/resources/content/aria/threat-events/testing.md
index 7515490..4ab4a04 100644
--- a/backend/src/main/resources/content/aria/threat-events/testing.md
+++ b/backend/src/main/resources/content/aria/threat-events/testing.md
@@ -3,7 +3,7 @@ module: aria.threat-events
 title: Threat Events
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Threat Events** (`aria.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/claims/claim-detail/testing.md b/backend/src/main/resources/content/claims/claim-detail/testing.md
index bdade7f..3540b3f 100644
--- a/backend/src/main/resources/content/claims/claim-detail/testing.md
+++ b/backend/src/main/resources/content/claims/claim-detail/testing.md
@@ -3,7 +3,7 @@ module: claims.claim-detail
 title: Claim Detail
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Claim Detail** panel (`claims.bcos.dev`). Open a claim, click through each tab, and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/claims/dashboard/testing.md b/backend/src/main/resources/content/claims/dashboard/testing.md
index 1bfab10..4cf115c 100644
--- a/backend/src/main/resources/content/claims/dashboard/testing.md
+++ b/backend/src/main/resources/content/claims/dashboard/testing.md
@@ -3,7 +3,7 @@ module: claims.dashboard
 title: Claims Dashboard
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Claims Dashboard** (`claims.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/claims/settings/testing.md b/backend/src/main/resources/content/claims/settings/testing.md
index 399d2f4..338c0a3 100644
--- a/backend/src/main/resources/content/claims/settings/testing.md
+++ b/backend/src/main/resources/content/claims/settings/testing.md
@@ -3,7 +3,7 @@ module: claims.settings
 title: Settings
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Claims → Settings** (`claims.bcos.dev`). The Settings screen is a **read-only** view of the effective vendor-email template — there is nothing to create or edit here. Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/claims/vendors/testing.md b/backend/src/main/resources/content/claims/vendors/testing.md
index c993c64..4766fb2 100644
--- a/backend/src/main/resources/content/claims/vendors/testing.md
+++ b/backend/src/main/resources/content/claims/vendors/testing.md
@@ -3,7 +3,7 @@ module: claims.vendors
 title: Vendors
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Vendor Registry** (`claims.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/dashboard/cash-stats/testing.md b/backend/src/main/resources/content/dashboard/cash-stats/testing.md
index f7756af..efeba59 100644
--- a/backend/src/main/resources/content/dashboard/cash-stats/testing.md
+++ b/backend/src/main/resources/content/dashboard/cash-stats/testing.md
@@ -3,7 +3,7 @@ module: dashboard.cash-stats
 title: Cash Stats
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Cash Stats** page (`dashboard.bcos.dev`). Click through in the UI and mark each row Pass or Fail. The page is **read-only** — there is nothing to create, edit, or delete, so testing is about what you can **see** and **filter**.
diff --git a/backend/src/main/resources/content/dashboard/overview/testing.md b/backend/src/main/resources/content/dashboard/overview/testing.md
index ce81a5b..e82ca34 100644
--- a/backend/src/main/resources/content/dashboard/overview/testing.md
+++ b/backend/src/main/resources/content/dashboard/overview/testing.md
@@ -3,7 +3,7 @@ module: dashboard.overview
 title: Fleet Overview
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Fleet Overview** landing page (`dashboard.bcos.dev`). Click through in the UI and mark each row Pass or Fail. This screen is **read-only** — there is nothing to create, edit, or delete, so testing focuses on what each card shows and on role scoping.
diff --git a/backend/src/main/resources/content/devices/agent-profile/testing.md b/backend/src/main/resources/content/devices/agent-profile/testing.md
index 481ebac..c0c48e2 100644
--- a/backend/src/main/resources/content/devices/agent-profile/testing.md
+++ b/backend/src/main/resources/content/devices/agent-profile/testing.md
@@ -3,7 +3,7 @@ module: devices.agent-profile
 title: Agent Profile
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Agent Profile** (Devices › Settings › Agent Profile, `devices.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/devices/agent-scripts/testing.md b/backend/src/main/resources/content/devices/agent-scripts/testing.md
index 198e4fa..04be6f3 100644
--- a/backend/src/main/resources/content/devices/agent-scripts/testing.md
+++ b/backend/src/main/resources/content/devices/agent-scripts/testing.md
@@ -3,7 +3,7 @@ module: devices.agent-scripts
 title: Agent Scripts
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Agent Scripts** (`devices.bcos.dev` → **Settings → Agent Scripts**). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/devices/config-audit/testing.md b/backend/src/main/resources/content/devices/config-audit/testing.md
index 07973bb..1a45155 100644
--- a/backend/src/main/resources/content/devices/config-audit/testing.md
+++ b/backend/src/main/resources/content/devices/config-audit/testing.md
@@ -3,7 +3,7 @@ module: devices.config-audit
 title: Config Audit
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Config Audit** in the Devices app (`devices.bcos.dev` → **Settings → Config Audit**, header reads **Config Change Audit**). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/devices/device-detail/testing.md b/backend/src/main/resources/content/devices/device-detail/testing.md
index fdf65e9..482919b 100644
--- a/backend/src/main/resources/content/devices/device-detail/testing.md
+++ b/backend/src/main/resources/content/devices/device-detail/testing.md
@@ -3,7 +3,7 @@ module: devices.device-detail
 title: Device Detail
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Device Detail** page (`devices.bcos.dev`). Open a device, click through the tabs and actions, and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/devices/device-groups/testing.md b/backend/src/main/resources/content/devices/device-groups/testing.md
index 014e6c3..d2415e4 100644
--- a/backend/src/main/resources/content/devices/device-groups/testing.md
+++ b/backend/src/main/resources/content/devices/device-groups/testing.md
@@ -3,7 +3,7 @@ module: devices.device-groups
 title: Device Groups
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Device Groups** (`devices.bcos.dev` → **Device Groups**). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/devices/device-list/testing.md b/backend/src/main/resources/content/devices/device-list/testing.md
index fc3e424..d122eee 100644
--- a/backend/src/main/resources/content/devices/device-list/testing.md
+++ b/backend/src/main/resources/content/devices/device-list/testing.md
@@ -3,7 +3,7 @@ module: devices.device-list
 title: Device List
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Device List** (`devices.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/devices/map/testing.md b/backend/src/main/resources/content/devices/map/testing.md
index 58258f4..6a45ff3 100644
--- a/backend/src/main/resources/content/devices/map/testing.md
+++ b/backend/src/main/resources/content/devices/map/testing.md
@@ -3,7 +3,7 @@ module: devices.map
 title: Map
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Fleet Map** (`devices.bcos.dev` → **Map**). It's a read-only view — no create/edit/delete. Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/devices/sw-deploy/testing.md b/backend/src/main/resources/content/devices/sw-deploy/testing.md
index 55a0d98..18a7e26 100644
--- a/backend/src/main/resources/content/devices/sw-deploy/testing.md
+++ b/backend/src/main/resources/content/devices/sw-deploy/testing.md
@@ -3,7 +3,7 @@ module: devices.sw-deploy
 title: Software Deployment
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **SW Deploy** tab (`devices.bcos.dev` → open a device → **SW Deploy** tab). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/fleet/artifacts/testing.md b/backend/src/main/resources/content/fleet/artifacts/testing.md
index 2a94f7e..8fab8fd 100644
--- a/backend/src/main/resources/content/fleet/artifacts/testing.md
+++ b/backend/src/main/resources/content/fleet/artifacts/testing.md
@@ -3,7 +3,7 @@ module: fleet.artifacts
 title: Artifact Import Guide
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Fleet → Artifacts** (`fleet.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/fleet/dashboard/testing.md b/backend/src/main/resources/content/fleet/dashboard/testing.md
index a1000e7..bdc876d 100644
--- a/backend/src/main/resources/content/fleet/dashboard/testing.md
+++ b/backend/src/main/resources/content/fleet/dashboard/testing.md
@@ -3,7 +3,7 @@ module: fleet.dashboard
 title: Fleet Dashboard
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Fleet Stats** dashboard (`fleet.bcos.dev`). It is a read-only screen — no create/edit/delete. Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/fleet/modules/testing.md b/backend/src/main/resources/content/fleet/modules/testing.md
index f358443..b32f3ba 100644
--- a/backend/src/main/resources/content/fleet/modules/testing.md
+++ b/backend/src/main/resources/content/fleet/modules/testing.md
@@ -3,7 +3,7 @@ module: fleet.modules
 title: Modules
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Agent Modules** screen (`fleet.bcos.dev`). This screen is a read-only reference catalog — there is nothing to create, edit, or delete. Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/fleet/patch-windows/testing.md b/backend/src/main/resources/content/fleet/patch-windows/testing.md
index e22b5c5..6dade7a 100644
--- a/backend/src/main/resources/content/fleet/patch-windows/testing.md
+++ b/backend/src/main/resources/content/fleet/patch-windows/testing.md
@@ -3,7 +3,7 @@ module: fleet.patch-windows
 title: Patch Window Guide
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Fleet → Patch Windows** (`fleet.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/fleet/tasks/testing.md b/backend/src/main/resources/content/fleet/tasks/testing.md
index bd6228c..fb1e5e6 100644
--- a/backend/src/main/resources/content/fleet/tasks/testing.md
+++ b/backend/src/main/resources/content/fleet/tasks/testing.md
@@ -3,7 +3,7 @@ module: fleet.tasks
 title: Fleet Task Workflow
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Fleet Tasks** (`fleet.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/incident/dashboard/testing.md b/backend/src/main/resources/content/incident/dashboard/testing.md
index c65663c..a09b967 100644
--- a/backend/src/main/resources/content/incident/dashboard/testing.md
+++ b/backend/src/main/resources/content/incident/dashboard/testing.md
@@ -3,7 +3,7 @@ module: incident.dashboard
 title: Dashboard
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Dashboard** (the **Overview** landing screen in the Incident app). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/incident/incident-management/testing.md b/backend/src/main/resources/content/incident/incident-management/testing.md
index 5dc9c37..2b78f97 100644
--- a/backend/src/main/resources/content/incident/incident-management/testing.md
+++ b/backend/src/main/resources/content/incident/incident-management/testing.md
@@ -3,7 +3,7 @@ module: incident.incident-management
 title: Incident Management
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Incident Management** (`incident.bcos.dev` → **Incident Mgmt › Incident List**). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/incident/incident-tracker/testing.md b/backend/src/main/resources/content/incident/incident-tracker/testing.md
index b55f489..f1a34b3 100644
--- a/backend/src/main/resources/content/incident/incident-tracker/testing.md
+++ b/backend/src/main/resources/content/incident/incident-tracker/testing.md
@@ -3,7 +3,7 @@ module: incident.incident-tracker
 title: Incident Tracker
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Incident Tracker** board (`incident.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/incident/journal-events/testing.md b/backend/src/main/resources/content/incident/journal-events/testing.md
index 337e08b..5425e4f 100644
--- a/backend/src/main/resources/content/incident/journal-events/testing.md
+++ b/backend/src/main/resources/content/incident/journal-events/testing.md
@@ -3,7 +3,7 @@ module: incident.journal-events
 title: Journal Events
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Event Journal** screen (the incident app on **bcos.dev**). This is a read-only, per-ATM event viewer — there is nothing to create, edit, or delete. Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/incident/processing-rules/testing.md b/backend/src/main/resources/content/incident/processing-rules/testing.md
index 115c633..c514a55 100644
--- a/backend/src/main/resources/content/incident/processing-rules/testing.md
+++ b/backend/src/main/resources/content/incident/processing-rules/testing.md
@@ -3,7 +3,7 @@ module: incident.processing-rules
 title: Processing Rules
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Processing Rules** (the incident app, `incident.bcos.dev`). Open the **Processing Rules** menu in the left sidebar and click through in the UI. Mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/msp/contact-groups/testing.md b/backend/src/main/resources/content/msp/contact-groups/testing.md
index 7e3c900..a36b2ae 100644
--- a/backend/src/main/resources/content/msp/contact-groups/testing.md
+++ b/backend/src/main/resources/content/msp/contact-groups/testing.md
@@ -3,7 +3,7 @@ module: msp.contact-groups
 title: Contact Groups
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Contact Groups** (MSP app → **Contact Groups**). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/msp/institution-keys/testing.md b/backend/src/main/resources/content/msp/institution-keys/testing.md
index fa4ef0b..732992c 100644
--- a/backend/src/main/resources/content/msp/institution-keys/testing.md
+++ b/backend/src/main/resources/content/msp/institution-keys/testing.md
@@ -3,7 +3,7 @@ module: msp.institution-keys
 title: Institution Keys
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Institution Keys** in the MSP app (`msp.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/msp/institutions/testing.md b/backend/src/main/resources/content/msp/institutions/testing.md
index 754bcdf..ecc1d12 100644
--- a/backend/src/main/resources/content/msp/institutions/testing.md
+++ b/backend/src/main/resources/content/msp/institutions/testing.md
@@ -3,7 +3,7 @@ module: msp.institutions
 title: Institutions
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the MSP **Institutions** screen (`msp.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/msp/module-allocations/testing.md b/backend/src/main/resources/content/msp/module-allocations/testing.md
index 2ad8bcc..d4aa2bb 100644
--- a/backend/src/main/resources/content/msp/module-allocations/testing.md
+++ b/backend/src/main/resources/content/msp/module-allocations/testing.md
@@ -3,7 +3,7 @@ module: msp.module-allocations
 title: Module Allocations
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Module Allocations** in the MSP admin SPA (`msp.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/msp/users/testing.md b/backend/src/main/resources/content/msp/users/testing.md
index 24ff651..e6ecb49 100644
--- a/backend/src/main/resources/content/msp/users/testing.md
+++ b/backend/src/main/resources/content/msp/users/testing.md
@@ -3,7 +3,7 @@ module: msp.users
 title: Users
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Users** screen (`msp.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/platform/guide-access/overview.md b/backend/src/main/resources/content/platform/guide-access/overview.md
index 4212646..0aa947b 100644
--- a/backend/src/main/resources/content/platform/guide-access/overview.md
+++ b/backend/src/main/resources/content/platform/guide-access/overview.md
@@ -28,14 +28,14 @@ model. `MarkdownGuideService.visible()` resolves it against the caller's role:
 |---|---|---|
 | `customer` | everyone signed in | (default) |
 | `internal` | MSP_ADMIN + BCOS_ADMIN | `isInternal()` |
-| `dev` | MSP_ADMIN + BCOS_ADMIN | `isInternal()` |
+| `dev` | **BCOS_ADMIN only** | `isBcos()` |
 | `bcos` | **BCOS_ADMIN only** | `isBcos()` |
 
 **Anonymous callers get nothing:** `/nav` returns `401` with no token.
 
-⚠️ **`dev` is a footgun.** It is named for developers but it gates at **MSP_ADMIN**, identically to
-`internal`. There is no role between MSP and BCOS. Anything you tag `audience: dev` is visible to
-customers' MSP admins. If a doc must stay in-house, tag it **`bcos`**, never `dev`.
+⚠️ **`dev` and `bcos` are both BCOS-only.** `dev` is developer/architecture content and must never
+be MSP-visible (issue #18). Only `internal` is shared with MSP admins. If a doc must stay in-house,
+tag it `dev` or `bcos`; never `internal` or `customer`.
 
 ## Role visibility matrix
 
@@ -45,23 +45,23 @@ customers' MSP admins. If a doc must stay in-house, tag it **`bcos`**, never `de
 | `customer` | The Data | 1 | 1 | 1 |
 | `internal` | Internal | – | 66 | 66 |
 | `internal` | Technical | – | 1 | 1 |
-| `dev` | Internal | – | 15 | 15 |
-| `dev` | Overview | – | 35 | 35 |
-| `dev` | Testing | – | 66 | 66 |
+| `internal` | Testing | – | 66 | 66 |
+| `dev` | Internal | – | – | 15 |
+| `dev` | Overview | – | – | 35 |
 | `bcos` | **Architect** | – | – | **81** |
 | `bcos` | **Claude** | – | – | **81** |
-| `bcos` | Overview | – | – | **8** |
-| | **modules visible** | **66** | **116** | **124** |
-| | **apps visible** | **13** | **17** | **19** |
+| `bcos` | Overview | – | – | **9** |
+| | **modules visible** | **66** | **66** | **125** |
+| | **apps visible** | **13** | **13** | **19** |
 
 ### What each role gets
 
-- **CUSTOMER** — the `Customer` tab only. No Internal, Testing, Architect or Claude, and none of
-  the `agent`, `platform`, `technical`, `devops`, `processes`, `milestone` apps.
-- **MSP_ADMIN** — the above plus `Internal`, `Testing` and `Overview`, and the `agent`, `platform`,
-  `technical` and `devops` apps (50 extra modules). **Not** Architect, **not** Claude.
-- **BCOS_ADMIN** — everything, including the two internal tabs (`Architect`, `Claude`) and the 8
-  BCOS-only modules: `processes.*` (5), `devops.dev`, `devops.prod`, `milestone.2026-07`.
+- **CUSTOMER** — the `Customer` tab only. 66 modules, no internal apps.
+- **MSP_ADMIN** — Customer, `internal`-tier `Internal`, and `Testing`. **No** Architect, Claude, or
+  any `dev` architecture (`technical.*` / `platform.*` Overviews, agent-module internals). Same 66
+  modules as CUSTOMER, with the extra operational + test tabs on them.
+- **BCOS_ADMIN** — everything: `dev` (Architect, Claude, dev Overview/Internal) and the `bcos` tier
+  (`processes.*`, `devops.dev`, `devops.prod`, `milestone.2026-07`, this page).
 
 ## Architect + Claude are BCOS-only (fixed 2026-07-14)
 
diff --git a/backend/src/main/resources/content/profile/appearance/testing.md b/backend/src/main/resources/content/profile/appearance/testing.md
index fc5e2fa..2fdf85e 100644
--- a/backend/src/main/resources/content/profile/appearance/testing.md
+++ b/backend/src/main/resources/content/profile/appearance/testing.md
@@ -3,7 +3,7 @@ module: profile.appearance
 title: Appearance
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Appearance** panel in Profile (`profile.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/profile/display/testing.md b/backend/src/main/resources/content/profile/display/testing.md
index 56b4797..5e41e3a 100644
--- a/backend/src/main/resources/content/profile/display/testing.md
+++ b/backend/src/main/resources/content/profile/display/testing.md
@@ -3,7 +3,7 @@ module: profile.display
 title: Display
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Profile → Display** (`profile.bcos.dev`). These are personal, per-user preferences — click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/profile/inbox/testing.md b/backend/src/main/resources/content/profile/inbox/testing.md
index 3106371..e9f522f 100644
--- a/backend/src/main/resources/content/profile/inbox/testing.md
+++ b/backend/src/main/resources/content/profile/inbox/testing.md
@@ -3,7 +3,7 @@ module: profile.inbox
 title: Inbox
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the Profile **Inbox** (on `bcos.dev`, open **Profile → Inbox**). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/profile/notifications/testing.md b/backend/src/main/resources/content/profile/notifications/testing.md
index 0a48f79..b7cb5ff 100644
--- a/backend/src/main/resources/content/profile/notifications/testing.md
+++ b/backend/src/main/resources/content/profile/notifications/testing.md
@@ -3,7 +3,7 @@ module: profile.notifications
 title: Notifications
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Notifications** settings screen (`profile.bcos.dev` → **Profile → Notifications**). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/profile/profile/testing.md b/backend/src/main/resources/content/profile/profile/testing.md
index 59d5897..6d91585 100644
--- a/backend/src/main/resources/content/profile/profile/testing.md
+++ b/backend/src/main/resources/content/profile/profile/testing.md
@@ -3,7 +3,7 @@ module: profile.profile
 title: Profile
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Profile** tab (`profile.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/profile/security/testing.md b/backend/src/main/resources/content/profile/security/testing.md
index 8b5a6e7..060df41 100644
--- a/backend/src/main/resources/content/profile/security/testing.md
+++ b/backend/src/main/resources/content/profile/security/testing.md
@@ -3,7 +3,7 @@ module: profile.security
 title: Security
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Security** screen in the **Profile** app. Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/recon/atm-cycle-history/testing.md b/backend/src/main/resources/content/recon/atm-cycle-history/testing.md
index e0b948c..e3beab4 100644
--- a/backend/src/main/resources/content/recon/atm-cycle-history/testing.md
+++ b/backend/src/main/resources/content/recon/atm-cycle-history/testing.md
@@ -3,7 +3,7 @@ module: recon.atm-cycle-history
 title: ATM Cycle History
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **ATM Cycle History** in the Reconciliation app (`recon.bcos.dev`). Open Reconciliation inside the HiveIQ Browser (**Cash Reconciliation** in the sidebar), click through in the UI, and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/recon/cash-forecast/testing.md b/backend/src/main/resources/content/recon/cash-forecast/testing.md
index ce90c38..11067e8 100644
--- a/backend/src/main/resources/content/recon/cash-forecast/testing.md
+++ b/backend/src/main/resources/content/recon/cash-forecast/testing.md
@@ -3,7 +3,7 @@ module: recon.cash-forecast
 title: Cash Forecast
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Cash Forecast** (`recon.bcos.dev` → **Cash Forecast**). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/recon/cash-reconciliation/testing.md b/backend/src/main/resources/content/recon/cash-reconciliation/testing.md
index f73ab1f..6394e60 100644
--- a/backend/src/main/resources/content/recon/cash-reconciliation/testing.md
+++ b/backend/src/main/resources/content/recon/cash-reconciliation/testing.md
@@ -3,7 +3,7 @@ module: recon.cash-reconciliation
 title: Cash Reconciliation
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Cash Reconciliation** — the fleet grid "ATM Cash Positions" (`recon.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/recon/device-cycle-mgmt/testing.md b/backend/src/main/resources/content/recon/device-cycle-mgmt/testing.md
index f872349..343a081 100644
--- a/backend/src/main/resources/content/recon/device-cycle-mgmt/testing.md
+++ b/backend/src/main/resources/content/recon/device-cycle-mgmt/testing.md
@@ -3,7 +3,7 @@ module: recon.device-cycle-mgmt
 title: Device Cycle Management
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Device Cycle Mgmt** in Cash Reconciliation (`recon.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/recon/recon-rules/testing.md b/backend/src/main/resources/content/recon/recon-rules/testing.md
index 1e5c6ad..e828c97 100644
--- a/backend/src/main/resources/content/recon/recon-rules/testing.md
+++ b/backend/src/main/resources/content/recon/recon-rules/testing.md
@@ -3,7 +3,7 @@ module: recon.recon-rules
 title: Recon Rules
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Recon Rules** (`recon.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/reports/builder/testing.md b/backend/src/main/resources/content/reports/builder/testing.md
index 67d02cb..704d5e3 100644
--- a/backend/src/main/resources/content/reports/builder/testing.md
+++ b/backend/src/main/resources/content/reports/builder/testing.md
@@ -3,7 +3,7 @@ module: reports.builder
 title: Report Builder
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Report Builder** (`report.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/reports/queries/testing.md b/backend/src/main/resources/content/reports/queries/testing.md
index 0d107fd..71a8d8f 100644
--- a/backend/src/main/resources/content/reports/queries/testing.md
+++ b/backend/src/main/resources/content/reports/queries/testing.md
@@ -3,7 +3,7 @@ module: reports.queries
 title: Saved Queries
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Saved Queries** (`report.bcos.dev`). Saved Queries live on the **Templates** tab — each report row has a **Queries** button. Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/reports/runs/testing.md b/backend/src/main/resources/content/reports/runs/testing.md
index 965935f..fbb35a4 100644
--- a/backend/src/main/resources/content/reports/runs/testing.md
+++ b/backend/src/main/resources/content/reports/runs/testing.md
@@ -3,7 +3,7 @@ module: reports.runs
 title: Run History
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Run History** (`report.bcos.dev` → **Run History** tab). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/reports/schedule/testing.md b/backend/src/main/resources/content/reports/schedule/testing.md
index 438d311..9c82126 100644
--- a/backend/src/main/resources/content/reports/schedule/testing.md
+++ b/backend/src/main/resources/content/reports/schedule/testing.md
@@ -3,7 +3,7 @@ module: reports.schedule
 title: Scheduling & Distribution
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Reports — scheduling & distribution** (`report.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/reports/templates/testing.md b/backend/src/main/resources/content/reports/templates/testing.md
index be8971c..dc55886 100644
--- a/backend/src/main/resources/content/reports/templates/testing.md
+++ b/backend/src/main/resources/content/reports/templates/testing.md
@@ -3,7 +3,7 @@ module: reports.templates
 title: Report Templates
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Report Templates** (`report.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/transactions/browser/testing.md b/backend/src/main/resources/content/transactions/browser/testing.md
index d1cf45e..719741d 100644
--- a/backend/src/main/resources/content/transactions/browser/testing.md
+++ b/backend/src/main/resources/content/transactions/browser/testing.md
@@ -3,7 +3,7 @@ module: transactions.browser
 title: Transactions Browser
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Transactions Browser** (`transactions.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/transactions/customer-journey/testing.md b/backend/src/main/resources/content/transactions/customer-journey/testing.md
index b636609..bec2391 100644
--- a/backend/src/main/resources/content/transactions/customer-journey/testing.md
+++ b/backend/src/main/resources/content/transactions/customer-journey/testing.md
@@ -3,7 +3,7 @@ module: transactions.customer-journey
 title: Customer Journey
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Customer Journey** (`transactions.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/transactions/journal-parsing/testing.md b/backend/src/main/resources/content/transactions/journal-parsing/testing.md
index bea52ee..155fa15 100644
--- a/backend/src/main/resources/content/transactions/journal-parsing/testing.md
+++ b/backend/src/main/resources/content/transactions/journal-parsing/testing.md
@@ -3,7 +3,7 @@ module: transactions.journal-parsing
 title: Journal Parsing Rules
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Journal Parsing** in the Transactions SPA (`transactions.bcos.dev`). Click through in the UI and mark each row Pass or Fail. The screen lives under **Settings → Journal → Parsing → ATM**.
diff --git a/backend/src/main/resources/content/transactions/processing-rules/testing.md b/backend/src/main/resources/content/transactions/processing-rules/testing.md
index d3dff72..103f5c1 100644
--- a/backend/src/main/resources/content/transactions/processing-rules/testing.md
+++ b/backend/src/main/resources/content/transactions/processing-rules/testing.md
@@ -3,7 +3,7 @@ module: transactions.processing-rules
 title: Journal Processing Rules
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Journal Processing Rules** (Transactions app › Settings, `transactions.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/transactions/reparse/testing.md b/backend/src/main/resources/content/transactions/reparse/testing.md
index 3e365ea..7d1123b 100644
--- a/backend/src/main/resources/content/transactions/reparse/testing.md
+++ b/backend/src/main/resources/content/transactions/reparse/testing.md
@@ -3,7 +3,7 @@ module: transactions.reparse
 title: Journal Reparse
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Journal Reparse** (Transactions SPA → **Settings → Journal Reparse**, `transactions.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/vault/cit-visits/testing.md b/backend/src/main/resources/content/vault/cit-visits/testing.md
index db6ec0d..e0821e6 100644
--- a/backend/src/main/resources/content/vault/cit-visits/testing.md
+++ b/backend/src/main/resources/content/vault/cit-visits/testing.md
@@ -3,7 +3,7 @@ module: vault.cit-visits
 title: CIT Visits
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **CIT Visits** (`vault.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/vault/dashboard/testing.md b/backend/src/main/resources/content/vault/dashboard/testing.md
index 6a2709b..f779444 100644
--- a/backend/src/main/resources/content/vault/dashboard/testing.md
+++ b/backend/src/main/resources/content/vault/dashboard/testing.md
@@ -3,7 +3,7 @@ module: vault.dashboard
 title: Dashboard
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for the **Vault Dashboard** (`vault.bcos.dev`). Click through in the UI and mark each row Pass or Fail.
diff --git a/backend/src/main/resources/content/vault/import/testing.md b/backend/src/main/resources/content/vault/import/testing.md
index 27eaf47..9ac6230 100644
--- a/backend/src/main/resources/content/vault/import/testing.md
+++ b/backend/src/main/resources/content/vault/import/testing.md
@@ -3,7 +3,7 @@ module: vault.import
 title: Import
 tab: Testing
 order: 35
-audience: dev
+audience: internal
 ---
 
 Frontend test checklist for **Import CIT Data** in Vault (`vault.bcos.dev` → **Import** in the sidebar). Click through in the UI and mark each row Pass or Fail.